An OS Command Injection flaw in Rapid7 InsightConnect SQLmap Plugin on Linux lets an attacker with authentication to the plugin run arbitrary operating system commands through the api_host or api_port parameters during connection setup. The weakness stems from insufficient input validation and is classified as CWE‑78. Successful exploitation would grant the attacker full control over the affected system, compromising confidentiality, integrity, and availability (C, I, and A) for the targeted environment.

The vulnerability affects Rapid7 InsightConnect SQLmap Plugin. No specific versions are listed in the advisory, so all installations of this plugin on Linux should be considered potentially vulnerable until a patch is applied.

The CVSS score of 6 indicates a moderate severity level, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers need valid credentials to the InsightConnect service and access to the plugin’s API to supply the vulnerable parameters. Because the plugin accepts these inputs without proper validation, the attack path is straightforward; an authenticated user can trigger arbitrary command execution, making the risk significant for organizations that run the plugin without additional safeguards.